Out-of-bounds memory access in the Linux kernel's NVIDIA Tegra Control Backbone (CBB) driver (soc/tegra: cbb) stems from an incorrect ARRAY_SIZE calculation in the fabric lookup tables, which can be triggered during a target timeout lookup on Tegra-based systems. A local, low-privileged attacker on affected Tegra hardware could read out-of-bounds kernel memory (information disclosure) or crash the system (denial of service), with CVSS 7.1. The flaw has been fixed upstream; there is no public exploit identified at time of analysis and EPSS is low at 0.17% (6th percentile).
Out-of-bounds memory access in the Linux kernel's Arm Mali 'komeda' DRM display driver allows a local low-privileged user to bypass AFBC framebuffer size validation via an integer overflow, supplying an undersized GEM buffer object that the driver treats as valid. Exploitation requires local access to the DRM device on hardware using the komeda driver, and there is no public exploit identified at time of analysis; EPSS probability is very low (0.16%, 6th percentile). The flaw was found by the Linux Verification Center using SVACE static analysis and is fixed across multiple stable kernel series.
Kernel-memory disclosure and denial of service in the Linux kernel's netfilter nf_tables subsystem arises from unsafe RCU list traversal: a netlink dump can walk a basechain/flowtable hook list concurrently with a ruleset update, racing on partially-published hooks. The fix publishes new hooks via splice_list_rcu() during the commit phase so RCU readers see a consistent list. EPSS is low (0.16%, 6th percentile) and there is no public exploit identified at time of analysis; the issue is a local race condition affecting privileged ruleset operations rather than a remotely reachable flaw.
Out-of-bounds kernel memory read in the Linux kernel's eBPF subsystem (pcpu_init_value) lets a local, low-privileged user with BPF access leak adjacent kernel memory and potentially crash the system. The flaw triggers when a per-CPU map is updated from a BPF_MAP_TYPE_CGROUP_STORAGE map whose value_size is not 8-byte aligned (e.g. 4 bytes), causing copy_map_value_long to read past the true source size. The issue is fixed in stable kernels; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.16%, 5th percentile).
Two-factor authentication bypass in Capgo before 12.128.2 allows an authenticated admin who has not completed 2FA enrollment to perform privileged organization management actions by replaying or modifying captured API requests. The flaw stems from 2FA being enforced exclusively in the frontend UI while the backend ORG management endpoints accept requests without verifying 2FA completion. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV.
Webhook signing secret disclosure in Capgo prior to 12.128.2 allows authenticated holders of non-admin API keys to read the webhook signing secret directly from the Supabase REST-exposed webhooks table because row-level security policies are too permissive. Once obtained, the secret lets the attacker forge valid X-Capgo-Signature headers and submit spoofed webhook events to any configured receiver, undermining webhook authenticity and integrity. No public exploit identified at time of analysis.
Arbitrary code execution in QOS.CH logback-core versions up to and including 1.5.34 allows a local attacker with existing privilege to run code in the context of any Java application that loads Logback when the Janino library is on the classpath. The flaw circumvents prior hardening for CVE-2025-11226 via conditional configuration file processing, and is triggered either by writing to an existing logback configuration file or by injecting an environment variable that points the process at a malicious configuration. No public exploit identified at time of analysis, though the bypass nature of the issue makes weaponization of existing CVE-2025-11226 exploit code plausible.